Artemis introduced Orion-1, a cyber-defense model that reconstructs attacks with evidence

What is changing?

Artemis Security introduced Orion-1, a foundation model post-trained for cyber defense, on October 8. It is designed to read logs across identity, cloud, endpoint, SaaS, network, and AI systems, decide whether activity represents an attack, and support the conclusion with evidence.

The company evaluated Orion-1 on threat detection, investigation, attack reconstruction, threat hunting, and activity correlation. Artemis says its own Decision-Grade Readiness benchmark placed the model above the tested general-purpose models, including GPT-6 Sol and Claude Opus 5.5, on the measured tasks. This is not an independent benchmark.

Orion-1 runs inside the Artemis platform and attaches evidence and confidence to each decision. Autonomy can be configured by action type, while high-impact actions require human approval by default. The company says customer data was not used for training.

The model is initially available in private preview to a small number of Artemis customers, with broader access planned later. The results should therefore be read as provider claims for a controlled product preview rather than a generally available model.